Bug 130949

Summary:	CAN-2004-0801 foomatic-rip arbitrary command execution issue
Product:	[Fedora] Fedora	Reporter:	Josh Bressers <bressers>
Component:	foomatic	Assignee:	Tim Waugh <twaugh>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	2	CC:	marius.andreiana, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	3.0.2-19	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-08-20 06:24:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2004-08-25 23:11:41 UTC

The cupsomatic driver in foomatic has an issue where if a properly
named file is handed to lpr for printing, it can cause arbitrary
command execution.

I'll attach the patch when it becomes available.

This issue should also affect FC1.

Comment 1 Tim Waugh 2004-09-10 12:02:06 UTC

Candidate packages built (FEDORA-2004-302, FEDORA-2004-303).  Awaiting
release date for push.

Comment 2 Josh Bressers 2004-09-15 14:04:16 UTC

Removing embargo

Comment 3 Marius Andreiana 2005-08-20 06:24:33 UTC

FC4 includes the fixes.